summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* ldb: version 1.3.1ldb-1.3.1Stefan Metzmacher2018-01-124-1/+284
| | | | | | | | | | | | * Intersect the index from SCOPE_ONELEVEL with the index for the search expression (bug #13191) * smaller/greater comparison tests * Show the last successful DN when failing to parse LDIF * ldb_index: Add an attriubute flag to require a unique value. * silence some clang warnings in picky developer mode Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* tevent: version 0.9.35tevent-0.9.35Stefan Metzmacher2018-01-122-1/+100
| | | | | | | | * Minor cleanup. wakeup_fd can always be gotten from the event context. * Use smb_set_close_on_exec() in example code. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* talloc: version 2.1.11talloc-2.1.11Stefan Metzmacher2018-01-124-1/+97
| | | | | | | * disable-python - fix talloc wscript if bundling disabled * Do not disclose the random talloc magic in free()'ed memory Signed-off-by: Stefan Metzmacher <metze@samba.org>
* talloc: Do not disclose the random talloc magic in free()'ed memoryAndrew Bartlett2018-01-121-30/+88
| | | | | | | | | | | This may help us avoid exploits via memory read attacks on Samba by ensuring that if the read is on an invalid chunk that the talloc magic disclosed there is not useful to create a valid chunk and so set a destructor. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13211 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* talloc: Add tests to require use-after-free to give the correct ↵Andrew Bartlett2018-01-121-0/+68
| | | | | | | | | talloc_abort() string BUG: https://bugzilla.samba.org/show_bug.cgi?id=13210 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* talloc: Remove talloc_abort_magic()Andrew Bartlett2018-01-121-15/+5
| | | | | | | | | | | | | The check required for talloc_abort_magic() prevents the 'access after free error' from being printed. It is also no longer possible to determine the difference between invalid memory and a talloc version mismatch as the magic is now random on many platforms. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13210 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* s3:tests: Fix test_net_tdb.sh with system tdb-toolsAndreas Schneider2018-01-101-2/+7
| | | | | | | | Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Wed Jan 10 18:30:56 CET 2018 on sn-devel-144
* selftest: Use the ad_dc with smbfs for ad_member envAndreas Schneider2018-01-101-3/+3
| | | | | | Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* selftest: split a large system invocation lineRalph Boehme2018-01-101-1/+3
| | | | | | | | | | Small cleanup for better code readability, no change in behaviour. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Ralph Böhme <slow@samba.org> Autobuild-Date(master): Wed Jan 10 05:19:26 CET 2018 on sn-devel-144
* selftest: split a large system invocation lineRalph Boehme2018-01-101-1/+5
| | | | | | | Small cleanup for better code readability, no change in behaviour. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* selftest: split a large system invocation lineRalph Boehme2018-01-101-1/+4
| | | | | | | Small cleanup for better code readability, no change in behaviour. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* selftest: set wrapper env variables when running net groupmapRalph Boehme2018-01-101-6/+19
| | | | | Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* selftest: remove second loop waiting for winbindd from wait_for_start()Ralph Boehme2018-01-101-11/+5
| | | | | | | A few lines above we already checked that winbindd is running. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* selftest: fix creation of builtin users in wait_for_startRalph Boehme2018-01-101-4/+23
| | | | | | | | | | | | | | | | | | | If "BUILTIN\Users" already exists, attempting to create it would fail, so we should check for the existence prior to the creation. It is unclear *why* the mapping sometimes already exist and sometime not. There are two places where they would have been created: 1. libnet_join_add_dom_rids_to_builtins tries to add the mapping when joining a domain, but at that point winbindd isn't running 2. when a user is authenticated in smbd, which clearly can't have happended when in the function wait_for_start Go figure... Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* s4:dns_server: avoid debug noise on successful updatesStefan Metzmacher2018-01-102-2/+2
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=12423 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s4:lib/tls: fix the developer build without gnutls supportStefan Metzmacher2018-01-101-0/+1
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* WHATSNEW: document the changes/deprecation of 'client schannel' and 'server ↵Stefan Metzmacher2018-01-101-0/+4
| | | | | | | schannel' Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* docs-xml: deprecate "server schannel" and change the default to "yes"Stefan Metzmacher2018-01-103-4/+13
| | | | | | | | No client should use the old protocol without DCERPC level integrity/privacy, but Maybe there're some lagacy OEM file servers, which require this. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* selftest: explicitly configure some dcs with 'server schannel = auto'Stefan Metzmacher2018-01-102-0/+3
| | | | | | | This is required for some tests. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* docs-xml: deprecate "client schannel" and change the default to "yes"Stefan Metzmacher2018-01-103-4/+11
| | | | | | | | This is already the default, because "require strong key = yes" is the default. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* WHATSNEW: document removal of 'use spnego" optionStefan Metzmacher2018-01-101-0/+1
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* docs-xml: remove deprecated 'use spnego" optionStefan Metzmacher2018-01-103-22/+0
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s4:smb_server: remove deprecated 'use spnego = no" handlingStefan Metzmacher2018-01-101-1/+0
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s3:smbd: remove deprecated 'use spnego = no" handlingStefan Metzmacher2018-01-101-1/+0
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s4:selftest: replace --option=usespnego= with --option=clientusespnego=Stefan Metzmacher2018-01-103-14/+18
| | | | | | | | | | | I guess that's what we try to test here, as 'use spnego' was only evaluated on in the smb server part. The basically tests the 'raw NTLMv2 auth' option, we set it to yes on some environments, but keep a knownfail for the ad_member. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* WHATSNEW: document removal 'winbind trusted domains only' optionStefan Metzmacher2018-01-101-0/+1
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* docs-xml: remove deprecated of 'winbind trusted domains only' optionStefan Metzmacher2018-01-103-25/+1
| | | | | | | This parameter is already deprecated in favor of the newer idmap_nss backend. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* winbindd: remove 'winbind trusted domains only' handlingStefan Metzmacher2018-01-104-36/+1
| | | | | | | This parameter is already deprecated in favor of the newer idmap_nss backend. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s3:g_lock: keep old mylock on error and don't store new mylock on errorStefan Metzmacher2018-01-101-2/+17
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
* winbindd: use setproctitleRalph Boehme2018-01-103-0/+12
| | | | | | Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* vfs_fruit: initialise bandsize to please a compilerDouglas Bagnall2018-01-101-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | GCC on a Ubuntu 16.04 instance said: [3174/4240] Compiling source3/modules/vfs_cap.c In file included from ../source3/include/includes.h:301:0, from ../source3/modules/vfs_fruit.c:20: ../source3/modules/vfs_fruit.c: In function ‘fruit_disk_free’: ../source3/../lib/util/debug.h:217:7: error: ‘bandsize’ may be used uninitialized in this function [-Werror=maybe-uninitialized] && (dbgtext body) ) ^ ../source3/modules/vfs_fruit.c:6302:9: note: ‘bandsize’ was declared here size_t bandsize; ^ [3175/4240] Compiling source3/modules/vfs_expand_msdfs.c [3176/4240] Compiling source3/modules/vfs_shadow_copy.c [3177/4240] Compiling source3/modules/vfs_shadow_copy2.c cc1: all warnings being treated as errors Waf: Leaving directory /home/ubuntu/autobuild/b17854/samba-o3/bin' Build failed: -> task failed (err #1): {task: cc vfs_fruit.c -> vfs_fruit_25.o} make: *** [all] Error 1 As far as I can tell, it is wrong, and the bandsize variable never gets passed uninititalised to DEBUG. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Ralph Boehme <slow@samba.org>
* python: Print the finddcs error messageVolker Lendecke2018-01-092-0/+6
| | | | | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Volker Lendecke <vl@samba.org> Autobuild-Date(master): Tue Jan 9 22:41:28 CET 2018 on sn-devel-144
* libnet: Add NULL checks to py_net_finddcVolker Lendecke2018-01-091-0/+10
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* vfs_fruit: set delete-on-close for empty finderinfoRalph Boehme2018-01-092-26/+36
| | | | | | | | | | | | | | | | | | | | We previously removed the stream from the underlying filesystem stream backing store when the client zeroes out FinderInfo in the AFP_AfpInfo stream, but this causes certain operations to fail (eg stat) when trying to access the stream over any file-handle open on that stream. So instead of deleting, set delete-on-close on the stream. The previous commit already implemented not to list list streams with delete-on-close set which is necessary to implemenent correct macOS semantics for this particular stream. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13181 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Ralph Böhme <slow@samba.org> Autobuild-Date(master): Tue Jan 9 17:09:12 CET 2018 on sn-devel-144
* vfs_fruit: filter out AFP_AfpInfo streams with pending delete-on-closeRalph Boehme2018-01-091-1/+71
| | | | | | | | | | | | | | | | | | | | | | This is in preperation of fixing the implementation of removing the AFP_AfpInfo stream by zeroing the FinderInfo out. We currently remove the stream blob from the underyling filesystem backing store, but that results in certain operations to fail on any still open file-handle. The fix comes in the next commit which will convert to backing store delete operation to a set delete-on-close on the stream. This commit adds filtering on streams that have the delete-on-close set. It is only needed for the fruit:metadata=stream case, as with fruit:metadata=netatalk the filtering is already done in fruit_streaminfo_meta_netatalk(). Bug: https://bugzilla.samba.org/show_bug.cgi?id=13181 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* vfs_fruit: factor out delete_invalid_meta_stream() from ↵Ralph Boehme2018-01-091-23/+34
| | | | | | | | | | | | fruit_streaminfo_meta_stream() No change in behaviour, just some refactoring before adding more code to fruit_streaminfo_meta_stream() in the next commit. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13181 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* s4/torture/fruit: enhance zero AFP_AfpInfo stream testRalph Boehme2018-01-092-3/+86
| | | | | | | | | | | This test more operations in the zeroed out FinderInfo test, ensuring after zeroing out FinderInfo, operations on the filehandle still work and that enumerating streams doesn't return the stream anymore. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13181 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* s4/torture/fruit: ensure AFP_AfpInfo blobs are 0-initializedRalph Boehme2018-01-091-1/+1
| | | | | | | Bug: https://bugzilla.samba.org/show_bug.cgi?id=13181 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* selftest: close connections after tests in samba4.ldap.rodc_rwdc.pythonJamie McClymont2018-01-092-0/+17
| | | | | | | | | | | | This test suite had a memory impact of around 2.5GB, from built-up LDAP connection handlers under the standard process model. Signed-off-by: Jamie McClymont <jamiemcclymont@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Tue Jan 9 08:22:27 CET 2018 on sn-devel-144
* pwrap: Build libpamtest as a subsystem to avoid issuesAndreas Schneider2018-01-081-2/+6
| | | | | | | | | | | Making it a subsystem adds the correct include directory for libpamtest.h. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Mon Jan 8 21:04:16 CET 2018 on sn-devel-144
* selftest: use net rpc join when joining NT4-style domainsRalph Boehme2018-01-081-1/+1
| | | | | | | | | | | | Otherwise net join when failing at the CLDAP ping stage will put a negative entry for the DC in the conncache which can trigger *hard* to debug problems later in winbindd. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Mon Jan 8 15:22:10 CET 2018 on sn-devel-144
* selftest: close connections after tests in samba4.ldap.secdesc.pythonJamie McClymont2018-01-081-0/+5
| | | | | | | | | | | | This test suite had a memory impact of around 2.2GB, from LDAP connection handlers under the standard process model. Signed-off-by: Jamie McClymont <jamiemcclymont@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Mon Jan 8 08:02:15 CET 2018 on sn-devel-144
* selftest: close connections after tests in samba4.ldap.acl.pythonJamie McClymont2018-01-081-0/+32
| | | | | | | | | | Over the length of a run of this suite (which runs under the standard process model), memory usage from LDAP connection handlers reaches 4GB. This patch reduces it to a manageable amount. Signed-off-by: Jamie McClymont <jamiemcclymont@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* docs-xml: mention that the man pages are "part of" version xBjörn Jacke2018-01-0875-75/+75
| | | | | | | | | writing that they are correct for version x is not always precise. But we're working on that also :-) Signed-off-by: Bjoern Jacke <bjacke@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* doc: document wins server's smb.conf parametersBjoern Jacke2018-01-0812-0/+171
| | | | | | | | this is from the WINS server, which was released earlier as samba4wins. Signed-off-by: Bjoern Jacke <bjacke@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* tests:docs: remove explicit exceptions for parametric optionsBjörn Jacke2018-01-081-5/+3
| | | | | | | | | we don't need to list them all as special cases because we exclude parametric options generally now from the default value test. Signed-off-by: Bjoern Jacke <bjacke@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* tests:docs: don't try to test parametric option defaultsBjörn Jacke2018-01-081-0/+3
| | | | | | | | we don't get the values of the parametric options. Signed-off-by: Bjoern Jacke <bjacke@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* packaging: add configure option to preprocess and install systemd filesAurelien Aptel2018-01-088-12/+87
| | | | | | | | | | Turn the systemd service files under packaging into template (.in) files with @VAR@ substitutions and add configure options to install and tweak them. Signed-off-by: Aurelien Aptel <aaptel@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* crypto: Update the REQUIREMENTSAndreas Schneider2018-01-081-23/+47
| | | | | | | | | | | | | | Update after call with the GnuTLS maintainer to see what is supported in GnuTLS, what is working in FIPS mode or not, and what features we require to move to GnuTLS in future. The benefit will be FIPS certification and more hardware accelerated crypto. Bugs have been opened against GnuTLS to implment the missing features or add functions to declare use of old crypto functions as non-crypto use. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* Add substitutions %t, %j, and %J as path-safe variants of %T, %i, and %I.Dr. Thomas Orgis2018-01-085-0/+170
| | | | | | | | | | | | Rationale: Using the existing substitutions in construction of paths (dynamic shares, created on client connect) results in directory names with colons and dots in them. Those can be hard to use when accessed from a different share, as Windows does not allow : in paths and has some ideas about dots. Signed-off-by: Dr. Thomas Orgis <thomas.orgis@uni-hamburg.de> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
View Lorry Controller Status